Dispute over digital vaccine data: Canton defends against criticism from data protection lawyers

Actually, it would be a practical solution: digital vaccination myvaccinations.ch are entered instead of documenting them with handwritten entries, stamps or stickers in the paper vaccination book. But the foundation that managed the platform went bankrupt in 2021. Federal data protection officer Adrian Lobsiger subsequently recommended that the data be deleted due to security flaws.

In June 2022, the canton of Aargau announced a rescue attempt for the data stored on Meineimpfungen.ch. The Ministry of Health and Social Affairs announced that they wanted to find a way to return the data to the population with the core community eHealth Aargau (SteHAG) and with the support of the Federal Office of Public Health (BAG).

Data Protection Officer Lobsiger gave his consent and an agreement was reached with the Bern-Mittelland Bankruptcy Office to take over the vaccination records of approximately 300,000 Swiss. Since then, however, the project has remained silent – until “Argovia Today” and the Aargauer Zeitung (AZ) reported last week that lawyer Martin Steiger criticized the rescue attempt.

The well-known lawyer, who specializes in digital law and data protection issues, barely dropped a stitch in his blog. He criticized, among other things, that the data was rotting away, that requests for removal and inspection were not answered and that the canton had used taxpayers’ money for the rescue operation.

The department of the Aargauer health director Jean-Pierre Gallati (SVP) has now commented on these and other points of criticism in an extensive statement. It states that SteHAG and DGS have “committed to handle data in accordance with data protection at all times”. Steiger had criticized that as long as the data was not deleted, it could be used for any purpose.”

The Ministry of Health states that the law prohibits the use of this data for other purposes without the information and consent of the data subjects. “These legal requirements are of course complied with”, the data would be secured and stored in accordance with data protection regulations. With a structured and widely supported preliminary process, which is about to be completed, it is checked “whether this data is in such a state that it can be saved”.

If the check was negative, SteHAG and DGS would have committed to destroy all data in an auditable and data protection compliant manner. Only if the result of the check is positive, a main project is started to implement the data protection rights of the data subjects.

In concrete terms, this means that anyone who has entered their data on Meinevaccinations.ch can decide to obtain it or have it destroyed. Any return of the data will only take place in consultation and with the consent of the cantonal and federal data protection authorities, according to the Gallati department.

Attorney Steiger said that Government Councilor Gallati had campaigned not only politically, but also with state money to save the data. The Aargau health department replies that this is wrong, Gallati did not use any cantonal money for the rescue attempt. The preliminary project is financed by the FPS Public Health, the financing of the main project is being negotiated.

Steiger has also stored his data on Meineimpfungen.ch and wants them finally removed. “I have already informed the bankruptcy office and recently also the eHealth Aargau parent community,” the lawyer says to “Argovia Today”.

As long as the preparatory project is running, no requests for information or removal from affected citizens can be answered, according to the canton’s statement.

(aargauerzeitung.ch)